Content security layer providing long-term renewable security

• US 20080130886A1
• Filed: 10/31/2007
• Published: 06/05/2008
• Est. Priority Date: 03/28/2001
• Status: Active Grant

• Current Assignee: Irdeto USA Incorporated (MultiChoice Group Ltd.)
• Original Assignee: Cryptography Research, Inc. (Rambus Inc.)
• Inventors: Carter, Matthew T., Kocher, Paul C., Jun, Benjamin C., Pearson, Peter K., Jaffe, Joshua M.
• Granted Patent: US 7,778,420 B2
• Time in Patent Office: Days
• US Class Current: 380/201
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00166 involving measures which result in a restriction to authorised contents recorded on or reproduced from a record carrier, e.g. music or software
• CPC Class Codes: G11B 20/00173 wherein the origin of the content is checked, e.g. determining whether the content has originally been retrieved from a legal disc copy or another trusted source
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00246 wherein the key is obtained from a local device, e.g. device key initially stored by the player or by the recorder
• CPC Class Codes: G11B 20/00659 involving a control step which is implemented as an executable file stored on the record carrier
• CPC Class Codes: G11B 20/00818 wherein the usage restriction limits the signal quality, e.g. by low-pass filtering of audio signals or by reducing the resolution of video signals
• CPC Class Codes: G11B 20/0084 wherein the usage restriction can be expressed as a specific time or date
• CPC Class Codes: G11B 20/00884 involving a watermark, i.e. a barely perceptible transformation of the original data which can nevertheless be recognised by an algorithm
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/608 Watermarking
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04N 2005/91335 the copy protection signal being a watermark
• CPC Class Codes: H04N 2005/91342 the copy protection signal being an authentication signal
• CPC Class Codes: H04N 21/26613 for generating or managing keys in general key distribution for secret or secure communication involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] H04L9/083; network support of key management H04L63/06; key management for network security in communication control or processing H04W12/04
• CPC Class Codes: H04N 21/4135 external recorder interface circuits between an apparatus for recording television signals and a television receiver H04N5/775
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4325 by playing back content from the storage medium reproduction of recorded television signals H04N5/76; reproduction of recorded television signals H04N9/79
• CPC Class Codes: H04N 21/4405 involving video stream decryption
• CPC Class Codes: H04N 21/44236 : Monitoring of piracy processes or activities protecting computer platforms against harmful, malicious or unexpected behaviour or activities using intrusion detection and counter measures G06F21/566; computer virus detection and handling G06F21/56
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/8355 : involving usage data, e.g. number of copies or viewings allowed
• CPC Class Codes: H04N 21/8358 : involving watermark protecting executable software by watermarking G06F21/16; image watermarking in general G06T1/0021; watermarks inserted in still images for transmission purposes H04N1/32144; inserting watermarks during video coding H04N19/467
• CPC Class Codes: H04N 5/913 : for scrambling ; for copy protection

Abstract

In an exemplary embodiment, digital content is mastered as a combination of encrypted data and data processing operations that enable use in approved playback environments. Player devices having a processing environment compatible with the content'"'"'s data processing operations are able to decrypt and play the content. Players can also provide content with basic functions, such as loading data from media, performing network communications, determining playback environment configuration, controlling decryption/playback, and/or performing cryptographic operations using the player'"'"'s keys. These functions allow the content to implement and enforce its own security policies. If pirates compromise individual players or content titles, new content can be mastered with new security features that block the old attacks. A selective decryption capability can also be provided, enabling on-the-fly watermark insertion so that attacks can be traced back to a particular player. Features to enable migration from legacy formats are also provided.

Claims

1. A method for enabling playback of encrypted digital video on a plurality of playback devices having different security characteristics, comprising the steps of:

(a) receiving, from a playback device, data describing said playback device;

(b) analyzing said received data to assess a risk that said digital video will be compromised by allowing playback on said device;

(c) based on said risk analysis, selecting from among a plurality of playback quality levels, where said levels include;

(i) playback with substantially full image quality;

(ii) playback at a reduced image quality; and

(iii) substantially preventing playback; and

(d) enabling said playback device to decrypt and output said digital video at said selected quality level.

2. The method of claim 1 where:

(a) said pluralities of playback quality levels of said digital video are distributed collectively to said player before said selection in step (c); and

(b) the step of enabling includes enabling said playback device to decrypt and output a version associated with selected playback quality level.

3. The method of claim 1 where:

(a) said method further comprises interrogating at least one of hardware, software, volatile memory and firmware to detect at least one predefined characteristic; and

(b) the step of selecting includes substantially preventing playback in dependence upon detection of the at least one predefined characteristic.

4. The method of claim 1 where:

(a) said method further comprises interrogating at least one item of output information associated with playback; and

(b) the step of selecting is performed in dependence upon results of interrogation.

5. The method of claim 1 further comprising interrogating a server over a network.

6. An optical medium containing encrypted digital video, playable on a plurality of playback devices having different security characteristics, comprising:

(a) encrypted digital video, playable on a plurality of playback devices having different security characteristics;

(b) program logic that, when executed, receives from a playback device on which it is executed data describing said playback device;

(c) program logic that, when executed, analyzes said received data to assess a risk that said digital video will be compromised by allowing playback on said device;

(d) program logic that, when executed, selects, based on said risk analysis, from among a plurality of playback quality levels, where said levels include;

(i) playback with substantially full image quality;

(ii) playback at a reduced image quality; and

(iii) substantially preventing playback; and

(e) program logic that, when executed, enables said playback device to decrypt and output said digital video at said selected quality level.

7. The optical medium of claim 6 where said program logic includes degradation logic that reduces the quality of said video to correspond to selected playback level.

8. The optical medium of claim 6 where:

(a) said optical medium further comprises a plurality of versions of said video, each version corresponding to a different playback quality and being encrypted using a respective cryptographic key; and

(b) said program logic in response to the selection of playback quality level, selects a corresponding version of said video and decrypts and outputs said corresponding version using the associated key.

9. The optical medium of claim 6 where said program logic further includes:

(a) logic that interrogates at least one item of output information associated with playback; and

(b) logic that selects from among the plurality of playback quality levels based upon results of interrogation.

10. The optical medium of claim 6 where said program logic further includes:

(a) logic that interrogates a digital certificate associated with the playback device; and

(b) logic that selects from among the plurality of playback quality levels based upon presence of a valid certificate.

11. The optical medium of claim 6 where said program logic further includes:

(a) logic that interrogates playback device form factor; and

(b) logic that selects from among the plurality of playback quality levels based upon detected playback device form factor.

12. An apparatus for enabling playback of encrypted digital video on a plurality of playback devices having different security characteristics, comprising:

(a) a memory adapted to store data describing a specific playback device;

(b) a processor;

(c) an interpreter, implemented using processor readable instructions, that when executed

(i) analyzes the data to assess a risk that said digital video will be compromised by allowing the specific playback device to access said digital video;

(ii) based on said risk analysis, selects from among a plurality of digital video quality levels, where said levels include

(A) substantially full image quality; and

(B) reduced image quality; and

(iii) enables the specific playback device to decrypt and output said digital video at said selected quality level.

13. The apparatus of claim 12 where the digital video quality levels further include a level where playback is substantially inhibited, and where said interpreter further includes instructions that when executed cause the specific playback device to not output decrypted digital video at any substantially quality level when the selected digital video quality level corresponds to substantially inhibited playback.

14. The apparatus of claim 12 further comprising a degradation module configured to reduce the quality of said digital video to correspond with said selected quality level.

15. The apparatus of claim 12 where:

(a) said apparatus further comprises processor readable instructions that when executed are adapted to select among different versions of encrypted video, each associated with a respective cryptographic key;

(b) said interpreter further includes instructions that when executed cause the specific playback device to decrypt and output a selected one of said versions using the associated cryptographic key.

16. The apparatus of claim 12 further comprising a network interface capable of receiving said digital video over the Internet.

17. The apparatus of claim 12 configured to obtain said digital video from an optically-readable medium.

18. The apparatus of claim 12 wherein said interpreter is adapted to interrogate a remote playback device and to enable the remote playback device to decrypt and output said digital video at the selected quality level.

19. The apparatus of claim 18 further comprising a video server adapted to provide encrypted digital video to the remote playback device at the selected quality level, and an encryption module that encrypts digital video at the selected quality level for transmission to the remote playback device.

20. The apparatus of claim 12 further comprising program logic, stored as processor readable instructions, for causing the interrogation of a specific playback device to detect a predefined characteristic of playback device hardware, playback device firmware, playback device software, and output information.

21. An apparatus comprising instructions stored on machine readable media, said instructions when executed causing a machine to:

(a) interrogate a video playback device to detect at least one predefined characteristic of playback environment;

(b) analyzing a result of interrogation to assess a risk that said digital video will be compromised by allowing playback;

(c) based on said risk analysis, selecting from among a plurality of playback quality levels, where said levels include

(i) playback with substantially full image quality, and

(ii) playback at a reduced image quality; and

(d) decrypt and output said digital video at said selected quality level in response to the selected quality level.

22. The apparatus of claim 21 where the instructions further when executed cause a machine to:

(a) select among a plurality of playback quality levels that includes a level corresponding to substantially inhibited playback; and

(b) substantially inhibit playback of decrypted video at any substantial quality level when a playback quality level is selected which corresponds to substantially inhibited playback.

23. A method of distributing encrypted digital video, playable on a plurality of playback devices having different security characteristics, comprising:

(a) executing program logic that

(i) receives from a playback device data describing playback environment,

(ii) analyzes received data to assess a risk that said digital video will be compromised by allowing playback,

(iii) selects, based on said risk analysis, from among a plurality of playback quality levels, including

(A) playback with substantially full image quality, and

(B) playback at a reduced image quality;

(b) distributing said encrypted digital video over a network for use by the playback device; and

(c) enabling the playback device to decrypt and output digital video corresponding to said selected quality level.

24. The method of claim 23 where:

(a) said method further comprises executing program logic that interrogates at least one of playback device hardware, software, volatile memory and firmware; and

(b) the step of selecting includes selecting from among a plurality of playback quality levels based upon a result of interrogation.

25. The method of claim 23, where:

(a) the plurality of playback levels includes a level where playback is substantially inhibited; and

(b) said method further comprises not-enabling the playback device to output decrypted digital video of any substantial quality when a playback level is selected that corresponds to substantially inhibited playback.